@protobase/server 0.30.1 → 0.31.0

package/dist/admin-options.d.ts

@@ -14,8 +14,8 @@ export type AdminOptions = {
   /** Default `/api/v1`. */
   basePath?: string;
   /**
-   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/rest/v1` and the
-   * Realtime-compatible `/realtime/v1` and the Storage-compatible `/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
+   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/api/sb/rest/v1` and the
+   * Realtime-compatible `/api/sb/realtime/v1` and the Storage-compatible `/api/sb/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
    * `PROTOBASE_SECRET_KEY`. Without either, or with `false`, the app serves neither.
    */
   apiKeys?: ApiKeysOptions | false;

package/dist/api-keys/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/api-keys/caller-settings.ts
 /**
-* The transaction settings a request admitted by key (`/rest/v1`, `/storage/v1`) runs with, as Supabase's PostgREST
+* The transaction settings a request admitted by key (`/api/sb/rest/v1`, `/api/sb/storage/v1`) runs with, as Supabase's PostgREST
 * sets them: `role`, which is `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/create-admin.d.ts

@@ -72,11 +72,11 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
-  /** @internal Verifies a user's token on `/rest/v1`, `/realtime/v1` and `/storage/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
+  /** @internal Verifies a user's token on `/api/sb/rest/v1`, `/api/sb/realtime/v1` and `/api/sb/storage/v1` and gives its claims, which tests fake; those `/api/sb/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
    * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves
-   * supabase-js's Realtime at `/realtime/v1/websocket`; without it, the app serves none.
+   * supabase-js's Realtime at `/api/sb/realtime/v1/websocket`; without it, the app serves none.
    */
   upgradeWebSocket?: UpgradeWebSocket;
 };

package/dist/create-admin.js

@@ -19,6 +19,7 @@ import { realtimeApp } from "./realtime/realtime-app.js";
 import { restRoutes } from "./rest/rest-routes.js";
 import { storageRoutes } from "./storage/storage-routes.js";
 import { readAppName } from "./app-name.js";
+import { realtimePath, restPath, storagePath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
@@ -237,7 +238,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			skip
 		});
 		app.use(`${systemPath}/*`, cors);
-		if (auth && !"/auth/v1".startsWith(`${systemPath}/`)) app.use(`${goTruePath}/*`, cors);
+		if ((servesKeys || auth) && !"/api/sb".startsWith(`${systemPath}/`)) app.use(`${supabasePath}/*`, cors);
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
@@ -288,19 +289,18 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		schema: changes,
 		report
 	});
-	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	if (servesKeys) {
 		const verify = verifyToken ?? (auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
 		const caller = apiKeyCaller({
 			keys: apiKeys,
 			verify
 		});
-		app.route("/rest/v1", restRoutes({
+		app.route(restPath, restRoutes({
 			deps,
 			caller,
 			report
 		}));
-		if (upgradeWebSocket) app.route("/realtime/v1", realtimeApp({
+		if (upgradeWebSocket) app.route(realtimePath, realtimeApp({
 			deps,
 			feed,
 			upgradeWebSocket,
@@ -317,12 +317,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 				maxBytes: files.storage.maxBytes,
 				caller
 			};
-			app.route("/storage/v1", storageRoutes({
+			app.route(storagePath, storageRoutes({
 				deps: storage,
 				report
 			}));
 		}
 	}
+	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));

package/dist/files/limits.d.ts

@@ -5,6 +5,11 @@ export type FileLimits = {
   maxBytes?: number | string;
   maxFiles?: number;
 };
+/** What `store` holds, in bytes and files, leaving out its own `.cleanup/` entries. */
+export declare const storeUsage: (store: FileStore) => Promise<{
+  bytes: number;
+  files: number;
+}>;
 /**
  * `store` refusing a file with `507` once it would hold more than `maxBytes` or `maxFiles`. Only files count, not the
  * store's own `.cleanup/` entries. What the store holds is counted with `list` on the first upload and again when the

package/dist/files/limits.js

@@ -4,6 +4,14 @@ import { parseSize } from "@protobase/schema/internal";
 //#region src/files/limits.ts
 /** How long a count of what a store holds is trusted before it is taken again. */
 const recountMs = 3e5;
+/** What `store` holds, in bytes and files, leaving out its own `.cleanup/` entries. */
+const storeUsage = async (store) => {
+	const files = (await store.list("")).filter((object) => isFilePath(object.path));
+	return {
+		bytes: files.reduce((sum, object) => sum + object.size, 0),
+		files: files.length
+	};
+};
 const limitReached = () => new HttpProblem(507, "storage-full", "Insufficient Storage", "The file storage is full; delete files to make room");
 var LimitReached = class extends Error {};
 const checkedFiles = (value) => {
@@ -27,10 +35,8 @@ const limitedFileStore = (store, limits, now = Date.now) => {
 	};
 	const usage = async () => {
 		if (counted && now() - counted.at < 3e5) return counted;
-		const files = (await store.list("")).filter((object) => isFilePath(object.path));
 		counted = {
-			bytes: files.reduce((sum, object) => sum + object.size, 0),
-			files: files.length,
+			...await storeUsage(store),
 			at: now()
 		};
 		return counted;
@@ -76,4 +82,4 @@ const limitedFileStore = (store, limits, now = Date.now) => {
 	};
 };
 //#endregion
-export { limitedFileStore, recountMs };
+export { limitedFileStore, recountMs, storeUsage };

package/dist/files/local-files.js

@@ -1,6 +1,7 @@
 import { HttpProblem } from "../problem.js";
 import { parseDuration } from "./duration.js";
 import { limitedFileStore } from "./limits.js";
+import { parseSize } from "@protobase/schema/internal";
 //#region src/files/local-files.ts
 const node = async () => ({
 	fs: await import("node:fs/promises"),
@@ -99,7 +100,8 @@ const localFiles = ({ dir, public: isPublic = false, publicUrl, retention, maxBy
 	}),
 	public: isPublic || publicUrl !== void 0,
 	...publicUrl !== void 0 && { publicUrl: publicUrl.replace(/\/$/, "") },
-	...retention !== void 0 && { retention: parseDuration(retention, "retention") }
+	...retention !== void 0 && { retention: parseDuration(retention, "retention") },
+	...maxBytes !== void 0 && { maxBytes: parseSize(maxBytes) }
 });
 //#endregion
 export { localFileStore, localFiles };

package/dist/files/options.d.ts

@@ -23,9 +23,9 @@ export type FilesOptions = {
    */
   trustedHosts?: string[];
   /**
-   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/storage/v1` when it has an API key
+   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/api/sb/storage/v1` when it has an API key
    * (see `apiKeys`): `provider` names one of the providers, default `private`, and `maxFileSize` caps every upload, as
-   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/storage/v1`.
+   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/api/sb/storage/v1`.
    */
   storage?: {
     provider?: string;

package/dist/files/runtime.js

@@ -1,6 +1,7 @@
 import { fileColumns, runCleanup } from "./cleanup-runner.js";
 import { storageCleanupSchedule } from "./cleanup-schedule.js";
 import { resolveProviders, retentionOf } from "./providers.js";
+import { storageProviderName } from "./storage-provider.js";
 import { createSigner } from "./signer.js";
 import { trustedImageHosts } from "./trusted-hosts.js";
 import { parseSize } from "@protobase/schema/internal";
@@ -9,19 +10,20 @@ import { parseSize } from "@protobase/schema/internal";
 const ticketSeconds = 86400;
 const imageFields = (models) => models.flatMap((model) => Object.values(model.fields).flatMap(({ name, file }) => file && (file.variants || file.original || file.placeholder !== void 0) ? [`${model.name}.${name}`] : []));
 /**
-* The runtime, when a resource has a file field, the config names providers or the app serves `/storage/v1`. It fails at startup when a field's
+* The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
 const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
-	const storage = servesStorage && options.storage !== false ? {
-		provider: options.storage?.provider ?? "private",
+	const storageName = servesStorage ? storageProviderName(options) : void 0;
+	const storage = storageName && options.storage !== false ? {
+		provider: storageName,
 		maxBytes: parseSize(options.storage?.maxFileSize ?? "50 MB")
 	} : void 0;
 	const fieldProviders = models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : []));
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
 	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
 	const images = imageFields(models);
 	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
 	const providers = resolveProviders(options, env, used);

package/dist/files/s3-files.js

@@ -1,6 +1,7 @@
 import { contentDisposition, servedType } from "./media-types.js";
 import { parseDuration } from "./duration.js";
 import { limitedFileStore } from "./limits.js";
+import { parseSize } from "@protobase/schema/internal";
 //#region src/files/s3-files.ts
 const codeOf = (error) => error instanceof Error ? error.code : void 0;
 /** A store in a bucket, under `prefix`. Downloads get presigned links, so their bytes never pass through the app. */
@@ -106,7 +107,8 @@ const s3Files = (options) => {
 		}),
 		public: isPublic || publicUrl !== void 0,
 		...publicUrl !== void 0 && { publicUrl: `${publicUrl.replace(/\/$/, "")}${folder === "" ? "" : `/${folder}`}` },
-		...retention !== void 0 && { retention: parseDuration(retention, "retention") }
+		...retention !== void 0 && { retention: parseDuration(retention, "retention") },
+		...maxBytes !== void 0 && { maxBytes: parseSize(maxBytes) }
 	};
 };
 //#endregion

package/dist/files/storage-provider.d.ts

@@ -0,0 +1,12 @@
+import { FileProvider } from "./store.js";
+import { FilesOptions } from "./options.js";
+//#region src/files/storage-provider.d.ts
+/**
+ * The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+ * command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
+ */
+export declare const storageProvider: (options: FilesOptions, env: Record<string, string | undefined>) => {
+  name: string;
+  provider: FileProvider;
+};
+//#endregion

package/dist/files/storage-provider.js

@@ -0,0 +1,18 @@
+import { resolveProviders } from "./providers.js";
+//#region src/files/storage-provider.ts
+/** The provider `/api/sb/storage/v1` keeps object bytes in: `files.storage.provider`, default `private`. */
+const storageProviderName = (options) => options.storage === false ? void 0 : options.storage?.provider ?? "private";
+/**
+* The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+* command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
+*/
+const storageProvider = (options, env) => {
+	const name = storageProviderName(options);
+	if (!name) throw new Error("files.storage is false in protobase.config.ts, so the app keeps no Storage objects");
+	return {
+		name,
+		provider: resolveProviders(options, env, [name])[name]
+	};
+};
+//#endregion
+export { storageProvider, storageProviderName };

package/dist/files/store.d.ts

@@ -42,5 +42,7 @@ export type FileProvider = {
   publicUrl?: string;
   /** Milliseconds between a file leaving its row and its bytes being deleted; default `files.retention` (0 when public). */
   retention?: number;
+  /** The most bytes its store takes (see `limitedFileStore`); unset for no limit. */
+  maxBytes?: number;
 };
 //#endregion

package/dist/gotrue/keys.js

@@ -1,6 +1,7 @@
+import { supabasePath } from "../supabase-paths.js";
 //#region src/gotrue/keys.ts
 /** Where the GoTrue-compatible endpoints are served, below the app's origin. */
-const goTruePath = "/auth/v1";
+const goTruePath = `${supabasePath}/auth/v1`;
 /** The key pair the JWT plugin keeps beside its EdDSA one for these tokens; it makes it on the first token. */
 const goTrueKeyPair = { alg: "ES256" };
 const goTrueAlgorithm = goTrueKeyPair.alg;

package/dist/index.d.ts

@@ -86,10 +86,12 @@ import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { FunctionEnv, PublicFunctionEnv, functionApp } from "./functions/function-app.js";
 import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
-import { FileLimits, limitedFileStore } from "./files/limits.js";
+import { FileLimits, limitedFileStore, storeUsage } from "./files/limits.js";
 import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
 import { StoreFileInput, storeFile } from "./files/store-file.js";
 import { S3Bucket, S3FilesOptions, S3ListPage, S3Object, s3FileStore, s3Files } from "./files/s3-files.js";
+import { storageProvider } from "./files/storage-provider.js";
+import { objectKey } from "./storage/object-key.js";
 import { FileCleanupInput, createFileCleanup } from "./files/file-cleanup.js";
 import { FileObject, FileVariantObject } from "./files/present.js";
 import { FileRef, formatUri, variantPath } from "./files/uri.js";
@@ -100,4 +102,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -21,6 +21,7 @@ import { webauthnPath } from "./better-auth/origins.js";
 import { apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
+import { objectKey } from "./storage/object-key.js";
 import { defaultAppName } from "./app-name.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
@@ -40,9 +41,10 @@ import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
-import { limitedFileStore } from "./files/limits.js";
+import { limitedFileStore, storeUsage } from "./files/limits.js";
 import { localFileStore, localFiles } from "./files/local-files.js";
 import { s3FileStore, s3Files } from "./files/s3-files.js";
+import { storageProvider } from "./files/storage-provider.js";
 import { isBackgroundWork, runInBackground } from "./background-work.js";
 import { mapSettings, mapStyleUrl, mapStyleVariable } from "./maps/map-settings.js";
 import { beforeSignInPluginsVariable, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable } from "./plugins/plugin-settings.js";
@@ -75,4 +77,4 @@ import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/p
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storeFile, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/realtime/change-checker.js

@@ -24,7 +24,7 @@ const seen = (entry, filters, rows) => new Map(rows.map((row) => [encodeKey(keyC
 }]));
 /**
 * Checks which changes callers may see, for every group in one read-only transaction: per group it sets the role and
-* claims as `/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
+* claims as `/api/sb/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
 * each filter in Postgres, as the column's type compares. The transaction holds one pooled connection only while it
 * runs. A group whose check fails is checked again in a transaction of its own, so it costs only its own callers the
 * batch.

package/dist/realtime/realtime-app.js

@@ -3,7 +3,7 @@ import { changeHub } from "./change-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
 //#region src/realtime/realtime-app.ts
 /**
-* `/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
+* `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
 * the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process.
 */
 const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {

package/dist/realtime/realtime-routes.js

@@ -10,7 +10,7 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 	...token !== void 0 && { authorization: `Bearer ${token}` }
 } });
 /**
-* `GET /realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
+* `GET /api/sb/realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
 * resources, and broadcasts and presence between the sockets of this process (see `realtimeSocket`). A missing or wrong
 * key is refused before the upgrade, with 401.
 */

package/dist/realtime/realtime-socket.js

@@ -11,7 +11,7 @@ const refusal = (error) => {
 	throw error;
 };
 /**
-* One WebSocket of `/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
+* One WebSocket of `/api/sb/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
 * `postgres_changes` bindings and an access token, token refreshes on an open channel, broadcasts with their `self`
 * and `ack` options, presence tracking, and leaves. A channel's token ends it when it expires, unless a newer one came
 * first. Messages are handled one at a time, in order. Private channels are refused for now.

package/dist/rest/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/rest/caller-settings.ts
 /**
-* The transaction settings a `/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
+* The transaction settings a `/api/sb/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
 * `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/rest/foreign-keys.js

@@ -15,7 +15,7 @@ const readForeignKeys = async (db) => {
 	return rows;
 };
 /**
-* The foreign keys of the `public` schema, which `/rest/v1` embeds through, read from the catalog once and kept for the
+* The foreign keys of the `public` schema, which `/api/sb/rest/v1` embeds through, read from the catalog once and kept for the
 * process lifetime, as the scan guard keeps indexes: migrations run before a new version serves.
 */
 const foreignKeyCache = (db) => {

package/dist/rest/parse-select.js

@@ -7,7 +7,7 @@ const embedPattern = /^(?:([^:(!]+):(?!:))?([^!(]+)((?:![^!(]+)*)\(([\s\S]*)\)$/
 const parseEmbed = (item) => {
 	const [, alias, nameText = "", modifiers = "", inner = ""] = embedPattern.exec(item) ?? [];
 	const name = nameText.trim();
-	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /rest/v1 does not support yet`);
+	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /api/sb/rest/v1 does not support yet`);
 	const flags = modifiers.split("!").slice(1).map((flag) => flag.trim());
 	const hint = flags.find((flag) => flag !== "inner" && flag !== "left");
 	return {

package/dist/rest/rest-error.js

@@ -1,6 +1,6 @@
 import { isDatabaseError } from "../error-handler.js";
 //#region src/rest/rest-error.ts
-/** A `/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
+/** A `/api/sb/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
 var RestError = class RestError extends Error {
 	status;
 	body;
@@ -66,7 +66,7 @@ const databaseStatus = (code, message, anonymous) => {
 	return codeStatus[code] ?? prefixStatus.find(([prefix]) => code.startsWith(prefix))?.[1] ?? 400;
 };
 /**
-* The `/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
+* The `/api/sb/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
 * message, detail and hint, which PostgREST passes on as they are. Other errors give `undefined`. Refusing a write by
 * RLS is 401 for an anonymous caller and 403 for others, as on Supabase.
 */

package/dist/rest/rest-routes.js

@@ -7,7 +7,7 @@ import { tableRoutes } from "./table-routes.js";
 import { Hono } from "hono";
 //#region src/rest/rest-routes.ts
 /**
-* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/rest/v1`. Each request runs in one
+* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/api/sb/rest/v1`. Each request runs in one
 * transaction as `anon`, `authenticated` or the app's own role, so the tables' RLS policies decide what it may read and
 * write. Errors come back as PostgREST's `{ code, details, hint, message }`; an unexpected one as a 500 that names
 * nothing of it.

package/dist/rest/rpc-route.js

@@ -38,7 +38,7 @@ const call = async (deps, c) => {
 		const source = callSource(chosen, args);
 		const query = parseQuery(params, c.req.header("range") ?? null, new Set(given));
 		const shape = query.select.map((item) => {
-			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /rest/v1 does not support yet`);
+			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /api/sb/rest/v1 does not support yet`);
 			return item;
 		});
 		if (chosen.info.returns === "void") {

package/dist/rest/table-routes.js

@@ -13,7 +13,7 @@ import { Hono } from "hono";
 import { sql } from "kysely";
 //#region src/rest/table-routes.ts
 /**
-* The resource whose table `name` is, in the `public` schema or the search path's: `/rest/v1` serves the tables the app
+* The resource whose table `name` is, in the `public` schema or the search path's: `/api/sb/rest/v1` serves the tables the app
 * declares as resources, as PostgREST serves those of its exposed schema. Any other is 404 (PGRST205).
 */
 const servedEntry = (deps, name) => deps.registry.entries.find((one) => one.model.table.name === name && (one.model.table.schema ?? "public") === "public");
@@ -181,7 +181,7 @@ const remove = async (deps, foreignKeys, c) => {
 	return withHeaders(writeResponse(written, object, 200, 204, `*/${counted(prefer, written.total) ?? "*"}`), warning);
 };
 /**
-* `/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
+* `/api/sb/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
 * and the rows a write returns embed related rows through `foreignKeys`.
 */
 const tableRoutes = (deps, foreignKeys) => {

package/dist/storage/object-key.d.ts

@@ -0,0 +1,9 @@
+//#region src/storage/object-key.d.ts
+/**
+ * Where an object's bytes are kept in the storage provider: `storage/<sha-256 of bucket and name>/<version>`. Names may
+ * hold any character, which no provider takes in a path; the hash takes every one, and the version keeps an upload apart
+ * from the one it replaces until the database says which is current. A row without a version, as an import may leave
+ * it, is at `unversioned`.
+ */
+export declare const objectKey: (bucket: string, name: string, version: string | null) => Promise<string>;
+//#endregion

package/dist/storage/storage-db.js

@@ -3,7 +3,7 @@ import { callerSettings } from "../api-keys/caller-settings.js";
 import { sql } from "kysely";
 //#region src/storage/storage-db.ts
 /**
-* Makes the rest of the transaction run as `caller`: its role and claims, as `/rest/v1` sets them (see
+* Makes the rest of the transaction run as `caller`: its role and claims, as `/api/sb/rest/v1` sets them (see
 * `callerSettings`), so the restored `storage.objects` and `storage.buckets` policies decide what it reads and writes.
 * What runs before it runs as the app's own role, which owns the tables.
 */

package/dist/storage/storage-routes.js

@@ -5,7 +5,7 @@ import { signedRoutes } from "./signed-routes.js";
 import { Hono } from "hono";
 //#region src/storage/storage-routes.ts
 /**
-* The Storage-compatible API `supabase.storage` calls, mounted at `/storage/v1`, over the app's storage provider. Every
+* The Storage-compatible API `supabase.storage` calls, mounted at `/api/sb/storage/v1`, over the app's storage provider. Every
 * read and write of `storage.objects` and `storage.buckets` runs as the request's caller (`anon`, `authenticated` or
 * the app's own role), so the policies restored with them decide; public buckets and signed URLs need no key. Errors
 * come back as Supabase Storage's `{ statusCode, error, message }`; an unexpected one as a 500 that names nothing of it.

package/dist/supabase-paths.js

@@ -0,0 +1,11 @@
+//#region src/supabase-paths.ts
+/** Where the Supabase-compatible endpoints live, below the app's origin: supabase-js takes `<origin>/api/sb` as its URL. */
+const supabasePath = "/api/sb";
+/** The PostgREST-compatible API of `from()` and `rpc()`. */
+const restPath = `${supabasePath}/rest/v1`;
+/** The Realtime-compatible socket of `channel()`. */
+const realtimePath = `${supabasePath}/realtime/v1`;
+/** The Storage-compatible API of `storage`. */
+const storagePath = `${supabasePath}/storage/v1`;
+//#endregion
+export { realtimePath, restPath, storagePath, supabasePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.30.1",
+  "version": "0.31.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.30.1",
-    "@protobase/query": "0.30.1",
-    "@protobase/schema": "0.30.1",
+    "@protobase/layout": "0.31.0",
+    "@protobase/query": "0.31.0",
+    "@protobase/schema": "0.31.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",